Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2023, 12:38

General

  • Target

    dcafcecb670ee03c93e64b24fdc679ea.exe

  • Size

    152KB

  • MD5

    dcafcecb670ee03c93e64b24fdc679ea

  • SHA1

    2026697210f5e8f3238796521eeedab48b9daff9

  • SHA256

    3fd5574fc364c6129b1fad05b2104bb69b40de01161c705b1caeb7184a91297a

  • SHA512

    5354a9c24009820ae7ee23a5b071d843d424673e7b77151fe42f19582bc2616ac114ecf28940d18f1dc1c65757732f5f6ab3f2f6d540145872442e7e11b7fcff

  • SSDEEP

    3072:YVo8QrrObb3Y20+iKskKM9H6IlfhAP8t7:1DribbjiCKM9/AE

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcafcecb670ee03c93e64b24fdc679ea.exe
    "C:\Users\Admin\AppData\Local\Temp\dcafcecb670ee03c93e64b24fdc679ea.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
        PID:4788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4788-1218-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/4788-2268-0x0000028F9A3D0000-0x0000028F9A3E0000-memory.dmp

      Filesize

      64KB

    • memory/4788-2211-0x00007FFED4110000-0x00007FFED4BD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4788-1221-0x0000028F9A3D0000-0x0000028F9A3E0000-memory.dmp

      Filesize

      64KB

    • memory/4788-1219-0x00007FFED4110000-0x00007FFED4BD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4796-173-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-177-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-143-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-147-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-145-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-149-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-151-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-153-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-155-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-157-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-159-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-161-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-163-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-165-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-167-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-169-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-171-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-133-0x0000029F2BA50000-0x0000029F2BA7A000-memory.dmp

      Filesize

      168KB

    • memory/4796-175-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-141-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-179-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-181-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-183-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-185-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-187-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-189-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-191-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-193-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-195-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-197-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-199-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-358-0x00007FFED4110000-0x00007FFED4BD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4796-506-0x0000029F2BEC0000-0x0000029F2BED0000-memory.dmp

      Filesize

      64KB

    • memory/4796-1214-0x0000029F2D880000-0x0000029F2D881000-memory.dmp

      Filesize

      4KB

    • memory/4796-139-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-137-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-136-0x0000029F47080000-0x0000029F471D1000-memory.dmp

      Filesize

      1.3MB

    • memory/4796-1220-0x00007FFED4110000-0x00007FFED4BD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4796-135-0x0000029F2BEC0000-0x0000029F2BED0000-memory.dmp

      Filesize

      64KB

    • memory/4796-134-0x00007FFED4110000-0x00007FFED4BD1000-memory.dmp

      Filesize

      10.8MB